Google TPU 8tx and TPU 8i Max: confidential inference and a two-chip package

Google has added two more systems to its eighth generation of Tensor Processing Units: TPU 8tx, built for confidential inference, and TPU 8i Max, a two-chip package aimed at very long context windows. Both were announced on 9 November 2026, which Google says makes four TPU systems in a single year, the first time it has done that. For teams that rent or buy AI accelerators, the interesting part is less the new names than what they say about how Google now builds TPUs: as configurable systems around existing silicon, with a software stack that is increasingly open source.

Key points

• Google announced TPU 8tx (confidential computing) and TPU 8i Max (two TPU 8i chips in one package) on 9 November 2026, joining TPU 8t and TPU 8i from April.
• TPU 8tx uses TPU 8t silicon with 5th Gen AMD EPYC host CPUs; AMD calls it the first cloud TPU system with hardware-enforced confidential computing.
• Google says TPU 8i Max has double the compute, double the SRAM and double the HBM bandwidth of TPU 8i, in the same rack footprint.
• Google's post gives no price, regions or general availability date for either system, and TestingCatalog reports the same gap.
• On the software side, Google open-sourced TPU Sync and says it cuts KV transfer latency and time to first token by more than 90%.

What happened

In a post by Amin Vahdat, Google's SVP and chief technologist for AI and infrastructure, the company said it was expanding its eighth-generation TPU portfolio. The generation began at Google Cloud Next in April with two specialised chips: TPU 8t for large-scale training and TPU 8i for real-time reasoning. Google said at the time that, against the previous generation, 8t offered up to 2.7 times better training performance and 8i 80% better inference price performance.

The two new systems are described as variations on that base rather than new chips:

• TPU 8tx is, in Google's words, "optimized for secure and confidential inference" and is also suited to small-scale training. It is built on the same silicon as TPU 8t and paired with 5th Generation AMD EPYC CPU hosts. It adopts the low-latency Boardfly network from the TPU 8i design, and Google says this delivers up to 2x lower latency compared with TPU 8t, with a near-zero performance penalty for the security features. The target customers are regulated enterprises and governments running proprietary models and agents next to sensitive data.
• TPU 8i Max puts two TPU 8i chips onto a single package. Google says it delivers double the compute, double the SRAM and double the HBM bandwidth of TPU 8i, and because it fits twice the silicon in the existing rack footprint, a data centre can deploy more compute per square foot and per watt.

Google also says TPUs now have nearly 100 customers, including frontier labs, trading firms, retailers and universities, and that customers can now deploy TPUs directly in their own data centres.

Background

Google first designed TPUs more than a decade ago for internal workloads such as voice recognition and translation. The business has since widened to training and serving Gemini, agent workloads, Google Cloud customers, and on-premises deployments.

The argument Google makes in this announcement is about speed of iteration. A new chip, it says, is a multi-year process bound by manufacturing. A system, meaning the compute, networking and storage around a chip and how they are packaged, can be changed in months. Google describes its TPUs as building blocks inside its AI Hypercomputer so that packaging, high-speed memory, optical networking and security can be adjusted without waiting for a new die.

That framing matters because accelerator buyers have been asking for different things. Google says some customers want accelerators that can reason across very large context windows, while highly regulated customers want specialised encryption capabilities. TPU 8tx and 8i Max are the answers to those two requests.

For more on how rival silicon vendors are packaging AI racks for national customers, see our report on NVIDIA, Rebellions and SK Telecom.

How it works

Confidential computing on TPUs. Data is normally encrypted when stored or sent over a network but has to be decrypted in memory while a computer processes it. Confidential computing aims to close that gap with hardware isolation. AMD's announcement says TPU 8tx uses AMD Secure Encrypted Virtualization (SEV) in the EPYC host, and that together with the TPU it extends protection beyond the CPU to the connected accelerators. According to AMD, the accelerator's identity and security configuration are verified before it is granted direct access to protected memory, and customer prompts, model weights and intermediate data stay encrypted in CPU memory and in transit between host and accelerators, with hardware isolation during accelerator execution.

Google's Mark Lohmeyer, quoted by AMD, called it "hardware-enforced confidential computing to cloud TPUs for the first time." Treat that as the two companies' claim: neither announcement describes an independent audit or attestation report we could check.

What the "tx" is for. Because it shares TPU 8t silicon, Google says teams can fine-tune on private data, distill large models into smaller ones, and run reinforcement learning on one system without moving sensitive data between clusters.

What "Max" means. TPU 8i Max addresses what Google calls the memory wall: when many agents work across a whole codebase or hours of video, memory bandwidth becomes the limit. TestingCatalog notes that Google's earlier published TPU 8i specifications list 288 GB of HBM, 384 MB of on-chip SRAM and 8,601 GB/s of memory bandwidth. Google's announcement says SRAM and bandwidth double for 8i Max but gives no absolute HBM capacity for the new package. If the doubling is exact, the SRAM figure works out to 768 MB, which is our arithmetic, not a number Google published.

TPU 8i Max768

TPU 8i384

On-chip SRAM per package (8i Max is double 8i per Google; 768 is our arithmetic) (MB)

	MB
TPU 8i Max	768
TPU 8i	384

Source: TestingCatalog (8i spec) and Google (doubling)

The software around it. Google paired the hardware with a list of software releases:

• TorchTPU, open-sourced last month, lets PyTorch code and Hugging Face models run natively on TPUs, with TPU backends for vLLM and SGLang.
• A TPU agent suite, now in preview and open source, plugs into Claude Code, Cursor and Google Antigravity to help with onboarding, bottleneck diagnosis and kernel tuning.
• An open-source XLA Serving Engine lets you train in Python and serve from a low-latency C++ runtime across TPUs, GPUs and CPUs.
• Agent Compute Engine suspends idle agent sessions and moves their working memory off the chip in milliseconds.
• TPU Sync, open source, tiers KV caches across HBM, host DRAM, storage and the network. Google says it cuts KV transfer latency and time to first token by more than 90%.
• Cloud Pathways is generally available on GKE, and GKE dynamic slicing is generally available. Google says dynamic slicing cuts job startup times by up to 5x and speeds fault recovery by up to 4.5x.

Google also says its native vLLM-TorchTPU stack reached state-of-the-art price-performance on the InferenceX and AgentX benchmarks. These are Google's own claims, and the post does not list the numbers behind them.

What it means

For developers: the practical change is that TPUs are being pitched as reachable from PyTorch without a rewrite. If your code already runs on GPUs through PyTorch, vLLM or SGLang, the barrier to trying a TPU is lower than it was, though how well it works on your model is something only your own tests will show.

For regulated industries: confidential inference is the headline. Banks, health systems and governments that have kept sensitive data off shared accelerators now have a TPU option that claims protection while data is in use. The claim comes with caveats: availability is unstated, and confidential computing designs are usually judged by their attestation and by independent security research, neither of which accompanied the announcement.

For AMD: TPU 8tx is a visible win for EPYC as the host CPU beside a custom accelerator. AMD says EPYC is the host CPU of choice for more than 10 leading hyperscalers and frontier AI labs, spanning GPUs and custom ASICs, including systems using Nvidia GPUs.

For Nvidia: Bloomberg framed the launch as Google escalating its rivalry with Nvidia, according to the headline of its report, which we could not open. The announcement itself does not name Nvidia, and it compares the new systems only with earlier TPUs.

What we don't know yet

• Pricing, regions and general availability dates for TPU 8tx and TPU 8i Max. One outlet reports a release next year; we could not confirm that with Google.
• The HBM capacity of TPU 8i Max.
• The benchmark figures behind the InferenceX and AgentX claims.
• How TPU 8tx's confidential computing is attested to customers, and whether it will be independently reviewed.
• Whether the "up to 2x lower latency" for TPU 8tx is measured on real inference workloads or a specific test.

What to watch next

Watch for a Google Cloud documentation page listing regions and quotas for TPU 8tx, which would be the first sign of real availability. Also watch for independent benchmarks of vLLM-TorchTPU, and for any security research on the confidential computing design once outside teams get access.

Sources

• Google: Our newest TPUs, 8tx and 8i Max, built for the agentic era (primary)
• AMD: AMD EPYC Expands Its Leadership at the Foundation of AI
• TestingCatalog: Google adds TPU 8tx and TPU 8i Max for AI workloads
• Bloomberg: Google escalates Nvidia rivalry with new versions of its TPU systems (headline only; page did not open)